00Frameworks
The obligation. The record that answers it.
Four frameworks, the obligations that touch AI activity records, and the artefact Ovelin produces for each. We map obligations to records. Your counsel decides what applies to you.
01EU AI Act
EU AI Act
The record-keeping and oversight articles are the ones an assessor opens first, because they are the ones you either have or you don't.
- Art. 12Record-keeping
- Every agent action is appended and sealed at the moment it arrives. Entries are never updated in place, so the log you show is the log that was written.
- Art. 14Human oversight
- Who reviewed which decision, with the reviewer's identity and the time they signed off, recorded against the specific action they reviewed.
02NIST AI RMF
NIST AI RMF
Structured around functions rather than clauses, so the evidence it wants is an inventory you keep current and measurements you can show moving.
- MapKnow what you run
- An inventory of every agent, with a risk rating computed from its data access and autonomy by the database rather than by whoever filled in the form.
- Measure · ManageTrack and respond
- Framework evidence recomputed from your actual records, and alerts when an agent starts touching more sensitive data than it used to.
03HIPAA
HIPAA
The audit-controls rule is short and specific: record and examine activity in systems that hold health information.
- 45 CFR § 164.312(b)Audit controls
- An append-only activity record for any agent touching health data, attributed to a named person rather than to a service account.
04ISO/IEC 42001
ISO/IEC 42001
Certification turns on documentation you can produce on request, which is mostly a question of whether it was being kept all along.
- AI management systemDocumented controls
- Inventory, oversight records, and an exportable binder generated from the real record, to support certification preparation.
What this is notOvelin records your agents' activity and maps it to framework requirements so you can evidence it. It does not certify you against any framework, it does not score compliance, and it is not legal advice.